| inputs | The inputs to pass to `zizmor`.
This should be a whitespace-separated list of inputs. Inputs will
be split with shell splitting rules.
| no | . |
| collect | The collection mode to use.
This can be 'all', 'default' (default), 'workflows', 'actions', or 'dependabot'.
See https://docs.zizmor.sh/usage/#input-collection for more information.
| no | default |
| online-audits | Whether to run online audits.
| no | true |
| persona | The auditing persona to use.
This can be 'regular' (default), 'pedantic', or 'auditor'.
| no | regular |
| min-severity | The minimum severity to report findings for.
This can be 'unknown', 'informational', 'low', 'medium', or 'high'.
| no | — |
| min-confidence | The minimum confidence to report findings for.
This can be 'unknown', 'low', 'medium', or 'high'.
| no | — |
| version | The version of zizmor to use | no | latest |
| token | The GitHub API token to use for zizmor online-audits (if enabled).
| no | ${{ github.token }} |
| advanced-security | Whether to enable GitHub Advanced Security for zizmor's results.
This will use the SARIF output format under the hood and will upload the
results to the repository's security tab.
| no | true |
| color | Whether zizmor should output colorized CLI output.
| no | true |
| annotations | Whether to emit GitHub annotations for zizmor's results.
This will use GitHub's workflow commands under the hood.
This option is **mutually exclusive** with `advanced-security: true`.
You must explicitly set `advanced-security: false` to enable this option.
| no | false |
| config | Path to a custom zizmor configuration file Path (e.g., zizmor.yml). | no | — |
| fail-on-no-inputs | Whether the action should fail if no inputs are collected by zizmor.
By default, zizmor will fail if it couldn't collect any inputs to audit.
Setting this option to `false` will make the action succeed in such cases,
with a warning message instead.
This input only works with zizmor v1.21.0 and later. Earlier versions
will always fail on no inputs.
| no | true |